Correct Settings For Hosted FreePBX 13
-
@JaredBusch what internal network is there when it's hosted???
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch said in Correct Settings For Hosted FreePBX 13:
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch I'm gonna retry all this from scratch tonight. Maybe use a $10 vm. Not doing any "tuning" though.
I was thinking with pjsip on 5060 should in be trunking down to 5160 and chan_sip from my soft switch?
outbound trunks still use chan_sip out to the other end's port 5060 like you are familiar.
I feel you are overcomplicating this entire thing.
I mean, if your tftp is "internal" how do the remote phones access it? Lol. Just doesn't follow any firewall lingo I've ever used...
You set your DHCP server to tell devices to look to your PBX for TFPT, or you preset all phones with the provisioning URL before sending them out.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch what internal network is there when it's hosted???
You obviously failed to read what I just just wrote.
I clearly stated that you need to understand that they are just labels to be friendly.
-
@JaredBusch your tftp is marked internal zone. Unless you have an onprem pbx it's not accessible from your local network.
You do know I'm only talking about hosted right?
I understand what they are doing here.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch your tftp is marked internal zone. Unless you have an onprem pbx it's not accessible from your local network.
You do know I'm only talking about hosted right?
I understand what they are doing here.
You do not understand.
Internal has nothing to do with where it is.
It is a label. Nothing more.
Any network you apply the Internal label to will have access to any service also marked Internal.
Those screen shots are from a system hosted on Vultr and those redacted sites are 3 different locations across Illinois and Missouri.
-
@JaredBusch I'm trying to figure out then how my remote phone gets marked "internal", is that where it tagged when it authenticates through the adaptive firewall?
Still, telling me to f*** off and go to my pbx team is a little harsh.
I'll find some reading on the firewall and stop asking questions? Can't imagine why people get so defensive... i feel like openbts and vsat is infinitely more complicated than this. There's just no documentation, freeswitch has infinitely better docs available.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
Still, telling me to f*** off and go to my pbx team is a little harsh.
Trust me, I did not tell you to f*** off. I have no qualms telling someone on here to f*** off. Just ask the mods.
I told you to think about your proposition. Meaning to think about the cost/benefit to the business for trying to do something out of band.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch I'm trying to figure out then how my remote phone gets marked "internal", is that where it tagged when it authenticates through the adaptive firewall?
I already told you how it gets marked internal. I even made a screenshot.
That is what I have been trying to tell you. There is nothing else here. you are making it too complicated.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
There's just no documentation, freeswitch has infinitely better docs available.
I never looked for any docs, so I am not sure what exists. The on screen instructions were plenty clear enough to enable me to understand this.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
@JaredBusch I'm trying to figure out then how my remote phone gets marked "internal", is that where it tagged when it authenticates through the adaptive firewall?
If your phone is on a remote network that is marked internal, then it never processes with the adaptive firewall it is already in a special category.
If you have a phone on a random network, not one defined explicitly in the network list described previously, contact your PBX and attempt to authenticate with SIP, the adaptive firewall will let it try. Assuming it registers, it is then marked by the adaptive firewall as a valid IP and services such as HTTPS provisioning will work. This is a bit of a chicken and egg scenario though. If the phone is not sent out provisioned, it has no way to register to then gain access to the provisioning server for future updates.
Is that what you are trying to figure out?
-
Honestly, after reading the freepbx wiki, your instructions make perfect sense, and I envy the clean setup you are running.
All remote client networks are set to "Internal" (mapping their wan ip to a dynamic FQDN)
Roaming phones coming through the responsive firewall apparently have access to "Internal" or "Other", whether or not that get applied a label I am not sure
The https provisioning is something I would much prefer over TFTP, and I see where my mix-up reading this from my mobile phone was...
I am assuming eth0 is marked as a External network?
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
I am assuming eth0 is marked as a External network?
Yes.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
Roaming phones coming through the responsive firewall apparently have access to "Internal" or "Other", whether or not that get applied a label I am not sure
They are internal from what I understand.
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
Honestly, after reading the freepbx wiki, your instructions make perfect sense, and I envy the clean setup you are running.
I can be more complicated. but that does not help a new person learning or guides designed for that.
Once, not if btw, you get a clean working system and want to begin to complicate it to match your needed design, feel free to ask for those kind of details if needed. But in a general post like this that would not have helped.
-
So, last night I had everything up in about 20 mins after starting from scratch. I also learned not to skim and respond from my mobile browser.
I am very interested in learning how to provision via https without the endpoint manager if you are willing to share your setup!
Thanks for your help...
-
@bigbear said in Correct Settings For Hosted FreePBX 13:
So, last night I had everything up in about 20 mins after starting from scratch. I also learned not to skim and respond from my mobile browser.
I am very interested in learning how to provision via https without the endpoint manager if you are willing to share your setup!
Thanks for your help...
Well eventually it will be posted here in detail. but i have not had time.
To provision, you simply need to make config files appropriately.
I use Yealink phones almost exclusively.
When a new phone is ordered i just leave it until a user needs it.
I have them plug it i and give me the IP address (can push the OK button to see).
I jump in it and assign the https provisioning URL and reboot the phone.
-
@bigbear i am on site today so not sure if I will have time to post a valid config example. But I can once I have a little time.
-
@JaredBusch said in Correct Settings For Hosted FreePBX 13:
@bigbear i am on site today so not sure if I will have time to post a valid config example. But I can once I have a little time.
Thanks. I was going to install the yealink provisioning configuration tool to generate some files later today. I had also been thinking about getting access to yealink's RPS, but not sure if it only works on new yealink phones you drop ship from vendors (versus existing yealinks in the feild)
If the latter it would be cool to have someone hold OK button down to reset to factory defaults, pickup provisioner URL from Yealink RPS and auto configure everything.
-
@bigbear The new firmware versions have a function in the phone settings that you can export a cfg file. that can get you started.
-
@JaredBusch ah sweet. Thanks!
Hate to be a pest, just had a couple more questions...
Was curious and wanted to ask about the extra zone entries in your screen shots above. the dns hosts for outbound1 and 2.letsencryptcom and mirror1.freepbx.org. Im guessing the freepbx.com ones are for software updates? Not sure if letsencrypt is for your SSL cert or a DNS mapping for trunk providers?
And I use IP auth for inbound calling, any need to define my IP for trunking?
